<?php
include("../configuration.php");
$host=$sqlhost; // Host name
$username=$sqluser; // Mysql username
$password=$sqlpassword; // Mysql password
$db_name=$sqldb; // Database name
$tbl_name="members"; // Table name

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");

// username and password sent from form
$subusername=$_POST['username'];
$subpassword=$_POST['password'];

// To protect MySQL injection (more detail about MySQL injection)
$subusername = stripslashes($subusername);
$subpassword = stripslashes($subpassword);
$subusername = mysql_real_escape_string($subusername);
$subpassword = mysql_real_escape_string($subpassword);

$sql="SELECT * FROM $tbl_name WHERE username='$subusername' and password='$subpassword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $subusername and $subpassword, table row must be 1 row

if($count==1){
// Register $subusername, $subpassword and redirect to file "login_success.php"
session_register("username");
session_register("password");
header("location:admin.php");
}
else {
echo "Wrong Username or Password - Please try again";
}
?>
